ASSOCIATION 

3^C0UNTIES 


NATIONAL 


NACo 



WRITTEN STATEMENT FOR THE RECORD 


HON. RICKY HATCH 
COUNTY CLERK/AUDITOR 
WEBER COUNTY, UTAH 


ON BEHALF OF THE NATIONAL ASSOCIATION OF COUNTIES 


CYBER-SECURING THE VOTE: ENSURING THE INTEGRITY OF THE U.S. ELECTION SYSTEM 


BEFORE THE COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 


UNITED STATES HOUSE OF REPRESENTATIVES 


JULY 24, 2018 
WASHINGTON, D.C. 


Chairman Gowdy, Ranking Member Cummings and members of the committee, thank you for the 
opportunity to testify on "Cyber-Securing the Vote: Ensuring the Integrity of the U.S. Election System." 

My name is Ricky Hatch and I currently serve as the elected Clerk Auditor for Weber County, Utah. 
Today, I am representing the National Association of Counties (NACo). In addition to my local 
responsibilities in Weber County, which include running elections, maintaining records and issuing 
marriage licenses, I am one of NACo's two appointees to the U.S. Election Assistance Commission (EAC) 
Board of Advisors. I also serve on the Government Coordinating Council (GCC) for the Election 
Infrastructure Subsector, which is jointly convened by the U.S. Department of Homeland Security (DHS), 
the EAC and the National Association of Secretaries of State (NASS). In addition to those roles, I am the 
Division Director for Election Officials for the International Association of Government Officials (iGO), an 
organization focusing on professional training and leadership development for county recorders, 
election officials, treasurers and clerks. 

Elections are the basic foundation of our democracy, and ensuring they are secure, fair and trustworthy 
are the basic goals and responsibilities of every election official across the country. Because all elections 
are local, I am here today to reiterate the importance of including local governments, and especially 
counties, in federal and state discussions to strengthen our national efforts to secure elections. 

About Weber County, Utah 

While Weber County is considered "suburban" with our population of approximately 250,000 residents, 
we have a diverse mix of urban, suburban and rural components. Located north of Salt Lake City, we 
encompass 659 square miles around our county seat of Ogden, Utah. In the 2016 presidential elections, 
Weber County conducted the election partially by mail, and had ten different polling places with 60 poll 
workers. We saw a significant growth in our voting population with nearly 45,000 new and updated 
registrations for the election and an overall turnout of 67.3 percent. 

About NACo 


Founded in 1935, NACo is the only national organization that represents county governments in the 
United States and brings together county officials to advocate with a collective voice on national policy, 
exchange ideas, build new leadership skills, pursue transformational county solutions, enrich the public's 
understanding of county government and exercise exemplary leadership in public service. 

About America's Counties 


Counties are highly diverse, not only in my state of Utah, but across the nation, and vary immensely in 
natural resources, social and political systems, cultural, economic and structural circumstances, public 
health and environmental responsibilities. Counties range in area from 26 square miles (Arlington 
County, Virginia) to 87,860 square miles (North Slope Borough, Alaska). The population of counties 
varies from Loving County, Texas, with just under 100 residents, to Los Angeles County, California, which 
is home to close to ten million people. Of the nation's 3,069 counties, approximately 70 percent are 
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considered "rural," with populations of less than 50,000, and 50 percent of these counties have 
populations below 25,000. At the same time, there are more than 120 major urban counties, which 
collectively provide essential services - including administering elections - to more than 130 million 
people every day. 

Many of the responsibilities of counties are mandated by both the states and federal government. While 
county responsibilities differ widely, most states give their counties significant authorities. These 
authorities include: administration of elections; construction and maintenance of roads, bridges and 
critical infrastructure; assessment of property taxes; record keeping; overseeing jails and court systems; 
and managing public hospitals and health systems. Counties are also responsible for child welfare, 
consumer protection, economic development, employment/workforce training, emergency 
management, land use planning, zoning and environmental protection. 

Today, I hope to highlight the important role counties and other local jurisdictions play in administering 
and securing elections, examine ways we can further collaborate between different levels of 
government and share the following three suggestions for federal action: 

1. Enact a dedicated funding stream for local governments for election administration and 
security 

2. Expand the federal government's efforts to provide technical assistance and best practices to 
local election officials 

3. Engage in a robust federalism process with state and local stakeholders regarding any future 
legislative or regulatory changes 

Counties play a key role in our nation's election system and work in collaboration with states to 
ensure the security and integrity of the process. 

The county role in elections complements the distinctly different role states generally play in the 
elections process. States are tasked with many administrative duties to ensure that elections run 
smoothly. The 2002 Help America Vote Act (HAVA) requires states to develop computerized, statewide 
voter registration lists, which counties use to administer elections at the local level. States continue to 
modernize voter registration through initiatives like online registration and automatic updates from 
motor vehicle departments. In addition to reducing the potential for voter fraud, the modernization of 
voter registration makes our elections more accessible to eligible citizens and reduces costs. As we have 
seen in recent elections, maintaining accurate lists is paramount to ensuring eligible and registered 
voters are not denied the opportunity to cast a ballot during an election. 

In addition to voter registration databases, states may help administer elections by tunneling or 
distributing information and resources from the federal government or working with local jurisdictions 
on voting equipment. In Maryland, for example, the State Board of Elections vets voting machines and 
helps deploy them, but mandates that counties pay for the equipment. 
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While states play an instrumental role in our nation's elections, counties and other local governments 
run elections on the ground. In almost every state, counties run the day-to-day operations of elections, 
and in every state, elections are broken down to local precincts for voting and administration. This 
means local governments are responsible for carrying out various key functions, from identifying polling 
places to printing ballots and protecting voting machines. The county official overseeing elections varies 
from state to state and may have one of several titles, including county clerk, county auditor or 
commissioner of elections. This official is responsible for overseeing the allocation of voting machines, 
managing polling locations, recruiting and training poll workers and ensuring the accessibility, integrity 
and efficiency of the voting process. 

There are almost 9,000 dedicated local election officials throughout the country. During the 2016 
election, counties supported over 100,000 polling locations and hired and trained over 800,000 poll 
workers. Counties of all sizes must undertake these tasks: according to data from the U.S. Election 
Assistance Commission (EAC), roughly 1,900 small counties reported having nearly 23,000 polling places 
in 2016 and over 130,000 poll workers. Counties with ten or fewer polling places had an average of 19 
poll workers in 2016, while some of these small jurisdictions had as many as 100 volunteer poll workers. 
Meanwhile, only about seven percent of counties had 100 or more polling places, and these counties 
hired and trained over 400,000 poll workers. 

County responsibilities for administering and securing elections begin well before Election Day and 
continue after votes are cast. 

Before an election takes place 

Prior to Election Day, county election officials have many responsibilities to ensure we are fully 
prepared for the election. 

From a cybersecurity standpoint, we are most acutely concerned with "social engineering" 
hacking attempts, which include phishing and baiting attempts through email. Counties also 
protect against direct hacks to access voter rolls to alter data and attempts to remove election 
information from county websites. For example, according to Utah Lieutenant Governor Spencer 
Cox, the state of Utah faces about one billion "hacking attempts" every day. Most hacks are 
unsuccessful and crude attempts, akin to a burglar driving down a street looking for open 
windows or jiggling the locks, but it only takes one breach to cause significant problems. 

Counties are also concerned with physical security measures prior to Election Day. We 

strategically place polling locations to ensure that they are accessible to voters and optimize the 
deployment of voting machines and poll workers, and to comply with federal and state 
requirements. Many counties enlist local law enforcement to conduct security sweeps of 
selected polling locations prior to Election Day. Counties also train poll workers to follow specific 
requirements regarding restrictions in and around polling locations. 
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Additionally, we vet, hire and train poll workers to ensure that they are well equipped to assist 
voters and protect against voter fraud or other security risks. Election officials also prepare for a 
wide range of "hard security" challenges at polling locations, including mitigating natural 
disasters and following protocols for an active shooter, fire, floods and other emergencies. 

Election Day 

On Election Day, election officials focus on ensuring the integrity of the voting systems 
themselves. These generally have four components: polling place management, voter 
verification and check-in systems (poll books and e-poll books), recording the vote using voting 
machines, ballot marking devices or paper ballots, and tabulating and reporting the results. 
Counties are meeting the unique security challenges presented by each of these components. 

Through the Help America Vote Act of 2002 (HAVA), Congress sought to improve the election 
process by promoting the latest technology and moving away from traditional lever and punch- 
card machines. Today, approximately three out of every five counties use optical scan 
technology, which employs a scanner to read marked paper ballots and record the results. Two 
out of five counties use direct recording electronic (DRE) equipment that allows voters to make 
their selections via touch screen or other digital interface and records the results on a secure 
memory device. 

Regardless of the type used, these voting machines are never connected to the internet or to 
each other. The transport and storage of voting machines, as well as ballots and vote 
tabulations, are directed by rigorous state and local security protocols. Voting machines are the 
voters' primary focus on Election Day, and though the type of machine each state or county uses 
varies, every state has specific policies governing voting machine setup. These controls include 
maintaining a verifiable chain of custody, pre-numbered tamper-evident seals, physical locks 
and documented reconciliations at the beginning, middle and end of Election Day. 

After an election 

Following Election Day, counties work with other municipalities and their state partners to 
certify the election results. This includes retaining vote counts and ballots, counting provisional 
ballots, verifying signatures and vote history, reconciling totals and preparing for a recount, if 
necessary. Additionally, many states and counties have implemented systems to "audit" the 
election results, including the security of the election. Each of these steps requires the retention 
and safeguarding of sensitive election information. 

It takes time, resources, expertise and money to constantly combat these threats and ensure the 
public continues to place its faith in our electoral system. The cost of running elections is difficult to 
calculate and varies by county. According to the California Institute of Technology/ Massachusetts 
Institute of Technology Voting Technology Project, county election expenditures were an estimated $1 
billion in 2000. 
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However, after HAVA was passed, substantial election reforms were implemented that included 
upgrading voting systems to ensure that voters could verify their selections before their ballot was cast. 
The need to continually upgrade voting machines to increase security and ensure accurate vote 
tabulations has increased the cost to run elections. The financial impact on counties varies depending on 
factors like how many voters vote by mail versus in person, how many machines are used in the county, 
the voting system vendor, state law requirements regarding the voting process, public expectations and 
many other factors. Costs, in addition to the actual equipment, can include transporting units to and 
from polling locations, the printing and mailing of paper ballots, poll worker pay, rent for polling 
locations, advertising, computers, other supplies and the annual maintenance of the machines. 

Our main goal as county election officials is to ensure safe and efficient elections, and to maintain the 
public's trust in these elections. We know communication is one of the best ways to build trust within 
our communities, and counties are employing various strategies to meet this challenge. For example, 
Maricopa County, Arizona implemented a Community Relations Team (CRT) in 2017 to engage in 
proactive outreach activities to empower communities and help organizations register and educate 
voters. Similarly, Carroll County, Maryland developed an interactive website and an enhanced social 
media presence and offers regular opportunities to correspond with candidates and election judges. 

President Dwight Eisenhower said, "Public confidence in the elective process is the foundation of public 
confidence in government." A voter's trust in the nation's elections process is driven by voter's 
experience with their local election office, whether they are registering to vote, receiving a ballot in the 
mail, using voting equipment at a polling place or checking out election results online. Local election 
officials are the face and voice of our nation's election infrastructure and drive the fundamental level of 
trust in each of our nation's elections. In fact, we are very detailed logistical planners, with backup plans 
for our backup plans. We're dedicated to the public trust and to doing things the right way, in full view 
of the public eye. 

Locally-run elections have been a part of our country since its beginning. However, in the last two 
centuries, election administration has evolved as technology, opportunities and threats have all 
changed. While meeting these challenges and integrating new technologies, counties have continuously 
worked to preserve the integrity and security of America's elections, and we will continue to work to 
combat these new, sophisticated risks to election security. 

A strong federal-state-local partnership is critical to securing our election systems. 

Although the federal government, states, counties and other local jurisdictions have different roles in 
our election process, we must all work together to ensure the broader security of the election system. In 
any given election, we are only as secure as our weakest link: a failure in the chain at any point could 
cause major problems for the rest of the system. Since HAVA was implemented in 2002, 
intergovernmental coordination has gradually improved, especially in the last two years, but we need to 
keep improving. 
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A key part of this success was the formation of the U.S. Election Assistance Commissioner (EAC), 
which helps states and local governments in a variety of ways. Establishing the EAC was a landmark 
moment for collaboration on voting guidelines, auditing the use of election funds and establishing a 
national clearinghouse of information on election administration. Since 2002, the EAC has served as a 
reliable partner and information hub for counties as we compile information on best practices, vendor 
authentication and examples of how other counties and states are meeting challenges or needs. 

Congress also boosted security efforts in the 2018 omnibus spending bill passed in March with the 
inclusion of $380 million in HAVA funds designated to improve election security. Many states are still 
determining how to prioritize the use of these extra funds. In Utah, we're using the funding to update 
and strengthen our statewide voter registration database software, buy more secure elections 
equipment and implement a more robust post-election audit process. We are also designating $300,000 
of the funds to employ a new "cyber navigator" consulting program that will assist counties throughout 
the state with training on how to defend against and detect cyber-attacks, as well as how to recover if 
an attack occurs. 

Additionally, the designation of election systems as critical infrastructure in 2017 under the U.S. 
Department of Homeland Security (DHS) catapulted the election community forward in its 
collaborative efforts. This led to the establishment of the Government Coordinating Council (GCC) in 
2017, where the inclusion of local officials was well received. One third of GCC members are local 
government officials and they serve as an active and helpful addition to the conversation. In my 
experience, DHS has responded to feedback extremely well through the development of the GCC, pilot 
programs and during other discussions regarding election cybersecurity. 

Furthermore, the focus on cyber-securing elections also led to the development of the Elections 
Infrastructure Information Sharing and Analysis Center (EI-ISAC) under the nonprofit Center for 
Internet Security (CIS), creating another central resource for election cybersecurity information that any 
local or state elections official can access. The EI-ISAC enables the quick dissemination of security alerts 
and best practices. Additionally, the completion of the CIS Handbook on Election Security earlier this 
year also gave many election offices a roadmap for both small and large steps we can take to further 
secure our systems. 

This enhanced coordination is also occurring at the state level. Most states are proactively working 
with counties and other municipalities to determine the best use of the additional $380 million included 
in the FY 2018 omnibus package. Meanwhile, some states are pursuing other partnership opportunities. 
In Iowa, the Secretary of State's (SOS) office formed a Cybersecurity Working Group with representation 
from DHS, the Iowa Office of the Chief Information Officer (OCIO), the Iowa Air National Guard, county 
auditors (election officials) and county information technology directors. The Iowa SOS also held two 
cybersecurity workshops for county elections and IT staff in June, and counties have taken advantage of 
several resources that the Iowa OCIO has made available at no cost to counties, including Enterprise 
Vulnerability Management, Intrusion Detection, a Security Operations Center and other training courses. 
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Moreover, vendors and the private sector are also pitching in to augment our election cyber defenses. 

These partnerships are essential for counties of all sizes. Google's Project Shield and CloudFlare's 
Athenian Project both help safeguard election websites from distributed denial of service (DDOS) 
attacks, which would result in a severe loss of publicly available information about polling locations, 
times and access points. Google also helps with email services to deter some of the social engineering 
attacks I discussed earlier. 

We are grateful that many of these conversations have included an increased opportunity for counties 
to be part of the intergovernmental process, but we still see opportunities for continued improvement. 

We must do more to secure the 2018 elections and future election cycles. 

Securing elections is not just a priority for 2018, nor is it necessary only for federal election cycles; it is a 
continuously changing landscape in constant need of attention, resources and interest. The more 
communication with county election officials, the better. 

While some progress is being made, counties are taking it upon ourselves to shore up our defenses at 
great cost. As the voting machines purchased with HAVA funds age, counties are shouldering the burden 
of replacing these machines with new and updated technologies. For example, Tazewell County, Illinois 
- a mid-size county with a population of 150,000 - recently spent $700,000 on new voting machines, 
only a small portion of which will be reimbursed by state and federal resources. Counties are also doing 
this proactively, like Black Hawk County, Iowa, which purchased new voting machines in 2016 when the 
county was financially stable, rather than risking a future crisis. 

Costs are not just confined to voting machines. Securing elections requires appropriate technological 
defenses and firewalls year-round. It also requires proper training for county staff and for volunteers 
and poll workers, hiring security before and during Election Day, safely transporting voting equipment 
and maintaining election information on the county website. 

This growing number of demands comes at a time when counties - regardless of size - are experiencing 
significant fiscal constraints. In many cases, our capacity to fund compliance activities with state and 
federal mandates, or to update technology to meet growing security threats, is limited. In fact, 45 states 
curb counties' property tax authority and only 29 states authorize counties to collect sales taxes, albeit 
with restrictions. Given these constraints, ensuring that our elections are free and secure will take 
continued assistance from our federal and state governmental partners. 

Therefore, to address existing election challenges and improve our collective security efforts, we 
respectfully offer the following suggestions: 

1) Counties support a dedicated, predictable federal funding stream to help local governments 
adequately secure elections, including upgrading and securing voting equipment. Local 
governments fund most election investments, but much of our equipment is exceeding its useful 
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life. Compounding this problem are our efforts to keep up with technology changes and stay 
ahead of hackers. 

While the omnibus and 2002 HAVA funding is a significant boost, often the resources get stuck 
at the state level. These dollars are needed at all levels, but they are especially vital at the 
county level with which voters interact the most. Furthermore, counties operate balanced 
budgets and approve future budgets up to two years before they are implemented, meaning 
uncertainty in the federal or state budgeting processes can leave counties unsure of if and when 
they will receive additional assistance. 

The development of a reliable funding mechanism for local governments would allow all three 
levels of government to collaboratively target funding in areas of greatest need. These funds, 
when accompanied with training and expertise from our state and federal partners, will help 
local election officials properly implement cybersecurity tools and educate the public to ensure 
that public trust in the election process stays strong. 

2) Counties support continuing and expanding the federal government's efforts to provide 
technical assistance and best practices to local election officials. In addition to funding, the 
federal government should continue to proactively work to distribute the available free 
resources to local elections officials. Only about nine percent of elections officials have joined 
the EI-ISAC to date, meaning the majority still lack access to proper information about the 
current risks they face and the appropriate resources that are available. 

Almost 80 percent of local election jurisdictions have fewer than 20,000 voters, and in many 
cases these small offices tend to be underfunded and are not staffed with cybersecurity experts. 
Therefore, a top priority for federal and state governments should be finding ways to involve 
these smaller jurisdictions and share already-available resources. As I mentioned earlier, a 
breach to even the smallest election office could have significant ramifications for the entire 
system. 

We urge the U.S Department of Homeland Security (DHS) to extend the availability of security 
clearances to local election officials, so that information can quickly flow between the entities 
most impacted by cyber threats. 

The federal government can also engage more directly with local election offices through 
trainings and sharing best practices. Each jurisdiction will have unique challenges. In some rural 
areas, a lack of broadband may prevent local election officials from engaging in enhanced 
technical training that is offered online. A "cyber navigator" program, like the one we are 
deploying in Utah, could help reach more remote offices. Urban areas also face challenges, 
where they must compete with the private sector in hiring and training cybersecurity staff as 
well as thousands of volunteer poll workers for every election. 
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3) Finally, Congress and federal agencies should undertake a robust federalism consultation 
process with states and local governments when considering any other changes to election 
cybersecurity or administration protocols. The development of the GCC, EI-ISAC and this 
hearing are clear examples of increased efforts from federal officials to include and 
communicate with local - and especially county - officials. We commend these efforts and 
encourage you to continue this trend. 

In conclusion 


Chairman Gowdy and Ranking Member Cummings, thank you again for inviting me to testify today. The 
most important way to guarantee we are working together to safeguard our elections is to ensure local 
officials - those running the elections on the ground - are included in the solutions. Inviting me to testify 
today is indicative of your commitment to including counties in these discussions, and I thank you both 
for your focus on this issue. 

Our nation's counties stand ready to work with Congress, federal agencies and our states to ensure the 
2018 election and any future elections are secure, fair and trustworthy. 
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